CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint
Unauthenticated attackers can read arbitrary JSON files via path traversal in the translations endpoint, exposing sensitive application data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105125?
CVE-2026-105125 is a medium-severity path traversal vulnerability in laradashboard, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.
Weakness: CWE-22
Which versions are affected by CVE-2026-105125?
How do I fix CVE-2026-105125?
No fix has been published for CVE-2026-105125 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-105125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105125 exists.
Sources
Also known as GHSA-43jp-66c9-7cgh, GHSA-px5g-fvm6-m9fr.